[ https://issues.jboss.org/browse/MODCLUSTER-417?page=com.atlassian.jira.pl... ] Radoslav Husar edited comment on MODCLUSTER-417 at 6/18/14 8:42 AM: -------------------------------------------------------------------- Hm, I am afraid it is not going to help with WildFly 8 and above anyway. If you proceed as an attacker such as: # create a request, remember the session id (somehow including the obfuscated route) # let the http session expire # spawn DOS attack with the same session id but since LB has no idea that is has already expired, it will be *always* routed to the same node # the node is going to create a new session and use key affinity service so that the session is local to that node # you can use all the new created sessions knowing they are all routed to the same node anyway # to DOS multiple different nodes at once, you can do the same and observe response rate degradation So the suggested approach is probably not going to help at all. was (Author: rhusar): Hm, I am afraid it is not going to help with WildFly 8 and above anyway. If you proceed as an attacker such as: # create a request, remember the session id (somehow including the obfuscated route) # let the http session expire # spawn DOS attack with the same session id but since LB has no idea that is has already expired, it will be *always* routed to the same node # the node is going to create a new session and use key affinity service so that the session is local to that node So the suggested approach is probably not going to help at all. -- This message was sent by Atlassian JIRA (v6.2.6#6264)